Software licensing and anti-piracy protection has been used for some time in the software industry as a means of controlling use of software, and more particularly, for the purpose of limiting or eliminating unauthorized use of software, known as software piracy.
The resulting economic dislocation that occurs due to software piracy is severe. As the cost of developing and supporting software programs increases, the need to reduce piracy grows. One of the key elements of reducing software piracy is through the use of an electronic software license, delivered to the authorized user to enable the software program to operate. The electronic license includes the required information in a form that is understood by the software program, and contains license terms.
License terms are the terms that apply to the use of the particular copy of the software program, and can include a start date, an end date, a number of program launches, fingerprint information to limit use on a specific local area network or on a specific machine, and other controlling information. For increased security, the electronic software license may be encrypted to hamper hacker efforts to bypass its function. This requires that the software program contain a decryption key to decrypt the license before extracting the information required.
One of the limitations of typical machine fingerprinting solutions is that the accessing of the fingerprint information and the determination of a correct, match is completed during the protection phase prior to the execution of the main application. Thus, if the application can be separated from the protection wrapper, it will execute correctly on any machine.
In addition to license files, other anti-piracy tools have been employed. These tools typically are used to add various types of authentication to the program being protected, such as decryption, checksum validation, and overriding various debug mechanisms in the operating system and hardware. All of these and other techniques were created for the purpose of making it difficult for a software hacker to break into the application code and remove it from its protection “wrapper” so it can be provided free of any license terms at no cost or very low cost, and where the software publisher receives no payment of any kind for its use. The process of adding protection software to a software application is often referred to as “wrapping.” Wrapping tools are typically sold to software developers who then perform the wrapping process on each software program prior to shipping the software to customers.
Since the runtime environment for the software program and its protection wrapper is typically unprotected, such as with Microsoft Corporation's Windows Operating System, and since a large number of programmers have extensive knowledge of programming on such a system, it is difficult to effectively protect software running on such machines. In addition to having extensive knowledge of the operating environment, hackers also can purchase or “borrow” a copy of the protection-wrapping tool. By studying the operation of the tool, the hacker gains a much deeper understanding of the protection mechanisms and techniques used by the tool than by studying only the resulting protected software, reducing the work required to compromise a given protected software product. In fact, the level of difficulty for breaking protected code without this additional aid is sufficiently high that most hackers will take great pains to acquire a copy of the protection tool for the purpose of studying its operation. Thus, it is extremely important to protect the wrapping tool itself. Otherwise, if the tool finds its way into the wrong hands, the security of every program wrapped for protection by the tool is at a substantially higher risk of being compromised.
Many of the techniques described above use encryption and debugging suppression features, often requiring kernel-level drivers to implement successfully and clandestinely. Unfortunately, this technique of using kernel-level drivers is susceptible to driver architecture changes and system configuration variations, and thus requires a high level of customer support. While the level of support required is reasonable for a small market, large markets cannot tolerate the support costs, and require other solutions.
Accordingly, what is needed is a method for obfuscation of program execution without using kernel level drivers, to make it difficult for a hacker to determine what work is being done by the application and its protection logic. Additionally, what is needed is a means of providing the toolset in a secure environment to eliminate the opportunity for studying the tool processing method, and thereby increasing the security of the protection. The present invention addresses such a need.